Submit a ticketCall us

Webinar: Web Help Desk for HR, Facilities and Accounting Departments
This webinar will focus on use cases for HR, Facilities and Accounting.

Having a unified ticketing and asset management system for all the departments in your company can provide end-users with a seamless experience and make things easier for your IT team. Yet, with different business tasks and objectives, many departments don’t fully understand the capabilities of Web Help Desk and how the software can be customized for effective use in their departments.
Register Now.

Home > Success Center > Netflow Traffic Analyzer (NTA) > The NPM interface charts are showing less bandwidth utilization than the Netflow charts

The NPM interface charts are showing less bandwidth utilization than the Netflow charts

Table of contents


Cases are generated due to Netflow charts showing less bandwidth utilization than NPM interface charts. 

There are several reasons this can happen.  This can be due to device configuration or application setting being disabled.

Depending on the make and model of the device it can make a difference on the troubleshooting steps to take.


  • All NTA versions
  • This can happen with multiple vendors 


1. Identify the make and the model of the device and see if 

If it's a Cisco 6500 series, see the configuration of the device. 

  1. Correctly identify the make and model of the device
    • If the device is a Cisco 6500 series first thing to look at is the configuration of the device.  Device configuration is usually the problem with this device.  The following command is usually missing “ip flow ingress layer2-switched vlan xxxx” which will cause switched layer 3 traffic not to be captured (compare customer device configuration with the following document .
  2. If device is something other than Cisco 6500 proceed with the following steps
  3. Verify the following command is configured
    • “ip flow-cache timeout active 1”  This will ensure that all cached flow data is exported every 1 minute.  By default long lived packed are exported every 30 minutes and could cause some spikes and a delay in data that will not show actual utilization during the same time as NPM.
  4. Check the NTA setting page and see if the following settings are enabled or disabled "Allow monitoring of flows from unmanaged interfaces" & "Enable Data retention for traffic on unmonitored ports".  When these are disabled they can cause flows to be dropped.
    1. NOTE: When this setting is disabled ""Allow monitoring of flows from unmanaged interfaces"  if both interfaces in the flow packet are not being managed in NPM the entire flow will be dropped
      • If packets are being dropped this can also be verified by checking the Netflow performance counters to see if the counters are increasing.
  5. If all the items mentioned above are set correctly perform a Wireshark capture and verify all required fields are properly populated.
    • Netflow required fields to gather full information  If some of the required fields are missing the entire flow will be dropped.   (NOTE: If interface if index values are zeros (0) data will not be captured in that direction. Also if only ingress or egress data is provided customer will be missing data in the Ingress or Egress direction)
      • SNMP Input interface ifindex value
      • SNMP Output interface ifindex value
      • Ingress bytes
      • Ingress packets
      • Protocol
      • Source UDT/TCP ports
      • Destination UDT/TCP ports
      • Source IP Address
      • Destination IP Address
      • Optional are IP ToS and AS value



Last modified
10:20, 6 Dec 2016